27. The fourth standard

27.—

1. The fourth standard is that personal data shall be accurate and, where necessary, kept up to date.

2. Subsection (1) shall not be regarded as being contravened by reason of any inaccuracy in personal data which accurately record information obtained by the data controller from the data subject, or a third party, in any case where the following requirements are met—

(a) having regard to the purpose for which the data were obtained and further processed, the data controller has taken reasonable steps to ensure the accuracy of the personal data; and

(b) if the data subject has notified the data controller of the data subject’s view that the personal data are inaccurate, the personal data indicate that fact.